{
  "cve": "CVE-2026-33466",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[8.0.0,8.19.13]"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Logstash",
          "source": "cna",
          "vendor": "Elastic"
        },
        "product": "logstash",
        "vendor": "elastic"
      }
    ],
    "analysis": {
      "en": {
        "generated_at": "2026-04-08T18:51:53.222096+00:00",
        "value": {
          "mitigation_remediation": [
            "Apply the latest Logstash update (8.19.14 or newer) to incorporate the vendor fix.",
            "If an immediate update is not possible, disable automatic pipeline reloading during the interim period.",
            "Restrict update endpoints to trusted sources and validate update integrity before deployment.",
            "Review file‑system permissions to ensure Logstash runs with the least privileges necessary.",
            "Monitor Logstash logs for unusual archive extraction activity and investigate any anomalies promptly."
          ],
          "summary": {
            "action": "Patch Now",
            "impact": "Remote Code Execution via arbitrary file write"
          },
          "threat_synthesis": {
            "affected_systems": "Elastic Logstash is affected. No specific product version information is supplied in the advisory, so all deployed Logstash instances should be inspected for recent update controls. The vulnerability exists wherever the archive extraction utilities are used without proper path validation.",
            "description_and_impact": "Improper limitation of pathname within Logstash when extracting compressed archives allows an attacker to craft a specially formed archive that writes files outside the intended directory. This lack of validation results in arbitrary file write and, in configurations with automatic pipeline reloading, can be escalated to execution of malicious code on the host. The weakness maps to CWE‑22, relative path traversal (CAPEC‑139).",
            "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity. EPSS data is not available, and the flaw is not yet listed in CISA’s KEV catalog, implying it may not yet be widely exploited. However, the attack requires an attacker to supply a crafted archive through a compromised or attacker‑controlled update endpoint, a mistake that is relatively easy to satisfy if the update channel is not tightly secured. Once the malicious archive is ingested, Logstash writes files with its own ownership, giving the attacker full access to the host filesystem where an automated pipeline reload could trigger arbitrary code execution. This combination of high severity, straightforward exploitation path, and potential for system‑wide compromise results in a high overall risk."
          }
        }
      }
    },
    "created": "2026-04-08T19:26:43.541307+00:00",
    "updated": "2026-04-08T19:38:59.430570+00:00",
    "vendors": [
      "elastic",
      "elastic$PRODUCT$logstash"
    ]
  },
  "epss": {
    "score": 0.00554
  },
  "mitre": {
    "cpes": [],
    "created": "2026-04-08T16:50:42.186000+00:00",
    "description": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.1,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/33xxx/CVE-2026-33466.json",
    "references": [
      "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
    ],
    "title": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write",
    "updated": "2026-04-10T03:56:01.015000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-22"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-04-08T18:26:00.557000+00:00",
    "description": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.1,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-33466.json",
    "references": [
      "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
    ],
    "title": null,
    "updated": "2026-07-24T23:10:00.563000+00:00",
    "vendors": [
      "elastic",
      "elastic$PRODUCT$logstash"
    ],
    "weaknesses": [
      "CWE-22"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-04-08T17:45:00+00:00",
        "data": [
          {
            "details": {
              "new": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-22"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 8.1,
                  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "9c8acfd1-df08-4f07-a171-fcfbfcc81d8e"
      },
      {
        "created": "2026-04-08T19:30:00+00:00",
        "data": [
          {
            "details": [
              "elastic",
              "elastic$PRODUCT$logstash"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "elastic",
                "elastic$PRODUCT$logstash"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "4f54639b-6769-4706-ae9c-9f0ea512408e"
      },
      {
        "created": "2026-04-08T20:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "b50a7dbd-1b7e-4a28-bf28-d7c03b52be9b"
      },
      {
        "created": "2026-04-22T00:00:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "bce5f09f-946b-45bd-8cfd-d3a6a3f2565e"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2026-04-08T16:50:42.186000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 8.1,
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00554
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-04-21T23:14:06.797000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "elastic",
        "elastic$PRODUCT$logstash"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-22"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-04-08T16:50:42.186000+00:00",
    "description": "Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write",
    "updated": "2026-04-08T19:13:04.010000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/33xxx/CVE-2026-33466.json",
    "weaknesses": []
  }
}